[BBLISA] Unusual date/time for Windows logout event

[Scott Ehrlich]

I reviewed the event viewer on a Windows XP machine, fully patched, that 
is on an isolated LAN, and discovered a single logoff from a user account 
at an unusual hour.  Just a few hours before that event, another user 
shows a login/logout at a normal time.

The configuration is a RedHat Enterprise 5 Server configured as a Samba Windows 
NT 4 domain, and Windows XP w/SP2 workstations as members.

Security is maintained tighly as I'm currently the only one with root/admin 
rights.   Everyone else is a general user.

What _might_ cause that one user to show a bizarre logout-only entry, and a 
bizarre time?

I'll also check my samba logs to see if they show anything.

Thanks for any insights.

Scott